Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit a8d6aa08dd3e004df6a6e63a61698d834a191ad3

Authored by Axel Lin
Committed by Samuel Ortiz
1 parent 7745cc8c3b
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

mfd: Fix off-by-one value range checking for tps6507x 

If bytes == (TPS6507X_MAX_REGISTER + 1), we have a buffer overflow when
doing memcpy(&msg[1], src, bytes).

Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Showing 1 changed file with 1 additions and 1 deletions Side-by-side Diff

drivers/mfd/tps6507x.c
Diff comments   View file @ a8d6aa0
... ... @@ -68,7 +68,7 @@
68 68 u8 msg[TPS6507X_MAX_REGISTER + 1];
69 69 int ret;
70 70  
71   - if (bytes > (TPS6507X_MAX_REGISTER + 1))
  71 + if (bytes > TPS6507X_MAX_REGISTER)
72 72 return -EINVAL;
73 73  
74 74 msg[0] = reg;